Mitchell County -- May 4, 2026: Mitchell County has confirmed that a cyberattack in October 2025 resulted in the theft of sensitive personal, financial, and health data from its systems. The county began sending written notices to affected residents on May 1, 2026, urging immediate action to mitigate potential risks such as identity theft and fraud.
The incident involved a ransomware attack detected on October 20, 2025. Cybercriminals had unauthorized access to county networks from October 16 to October 20, 2025, during which data was exfiltrated. While initial outages were described as "technical issues" in late October 2025, a public statement followed on December 19, 2025. The county completed its full data review on April 1, 2026, leading to the recent notifications.
The breach primarily impacted individuals receiving services from the Mitchell County Department of Social Services (DSS) in Bakersville. Compromised information includes personal identifiers such as name, address, Social Security number, and driver's license or state ID number. Financial account information, protected health information (PHI), medical record numbers, biometric information, and in some cases, online account names and passwords were also compromised. Due to the involvement of PHI, the county notified the U.S. Department of Health and Human Services.
In response, Mitchell County is offering complimentary credit monitoring where appropriate and has implemented several security enhancements. These measures include strengthening system monitoring, upgrading email platforms, enhancing detection software, and tightening password policies and access restrictions. County Manager Allen Cook stated, “The privacy and security of the information we maintain is very important to us, and we remain committed to doing everything we can to maintain the confidentiality of such information.”
Officials are urging Mitchell County residents, especially those who received notices, to take immediate steps to protect themselves:
Monitor Accounts: Regularly check financial statements, credit reports (available annually for free at AnnualCreditReport.com), and health insurance Explanation of Benefits (EOB) forms for any suspicious or unauthorized activity.
Credit Monitoring: Contact credit bureaus such as Experian, Equifax, and TransUnion for resources. The county may provide free credit monitoring services to affected individuals.
Identity Theft Help: For assistance with identity theft, contact the Federal Trade Commission (FTC) at 877-438-4338 or visit consumer.ftc.gov/features/identity-theft.
Report Issues: Notify law enforcement immediately if you discover any unauthorized activity. Consider placing fraud alerts or credit freezes with the major credit bureaus.
Additional Steps: Change passwords for any online accounts that may have been compromised and remain vigilant against phishing attempts via email or text messages.
The county continues to monitor its systems following the incident. Residents are encouraged to remain proactive in safeguarding their personal information.